Development of Performance Assessment Methodologies

Development of Performance Assessment MethodologiesDevelopment of Performance Assessment Methodologies
Development of Performance Assessment Methodologies
André Rübel Dirk-Alexander Becker Eckard Fein Alice Ionescu Thomas Lauke Jörg Mönig Ulrich Noseck Anke Schneider Sabine Spießl Jens Wolf
October 2010
Remark:
This report was prepared under contract no. 02 E 10276 with the Federal Ministry of Economics and Technology (BMWi).
The work was conducted by the Gesellschaft für Anlagen- und Reaktorsicherheit (GRS) mbH.
The authors are responsible for the content of this report.
GRS - 259 ISBN 978-3-939355-34-2
I
Abstract
The project PAMINA (Performance Assessment methodologies in application to guide
the development of the safety case) was conducted from 2007 to 2009 on the Europe-
an level to improve and harmonise integrated performance assessment methodologies
and tools for various disposal concepts of long-lived radioactive waste and spent nu-
clear fuel in different deep geological environments. The following report presents the
contributions of the GRS Braunschweig to the PAMINA project comprising the following
topics:
− Overview of methodologies, tools and experiences:
A comprehensive review is presented from the point of view of the implementer to
assess the state of the art of the methodologies and approaches needed for the
safety assessment of geological repositories for the German national programme,
and to distil the lessons learned from the rich experience accumulated in their de-
velopment and application.
− Treatment of uncertainty in integrated performance assessment:
A protocol is presented that helps to determine adequate probability density func-
tion for parameter values to deal with parameter uncertainties in probabilistic safety
analyses.
Different sensitivity analysis methods have been tested for a performance
assessment model for a high-level waste repository in rock salt. These methods
include variance based FAST and EFAST methods.
− Use of safety indicators and performance indicators:
Different safety and performance indicators have been tested for high level waste
repositories in rock salt and clay formations. For the repository in clay sensitivity
analysis methods have been tested to gain deeper insight into the performance of
subsystems.
− Relevance of sophisticated approaches in practical cases:
The performance assessment approach to three selected near-field processes in a
repository in salt have been tested for their suitability. The three processes are
convergence of salt, brine intrusion into a backfilled drift and convective driven
transport. Additionally, the relevance of the complexity of modelling for the far field
of a repository in salt has been assessed.
II
III
2.1 Current status of the German national context regarding repository
projects ...................................................................................................... 5
2.2.1 Background/Introduction ............................................................................ 7
2.2.3 Treatment in the safety case.................................................................... 10
2.2.3.1 Methodology ............................................................................................ 11
2.2.3.5 On-going work and future evolution ......................................................... 16
2.2.4 Lessons learnt ......................................................................................... 17
2.3.1 Background/Introduction .......................................................................... 18
2.3.3.1 Methodology ............................................................................................ 21
2.3.4 Lessons learnt ......................................................................................... 29
2.4.1 Background ............................................................................................. 30
2.4.3.1 Safety concept ......................................................................................... 32
2.4.4.1 Normal evolution scenario ....................................................................... 34
2.4.4.2 Altered evolution scenarios ...................................................................... 38
2.4.5 Lessons learnt and outlook ...................................................................... 39
2.5 Modelling strategy ................................................................................... 40
2.5.2 Regulatory requirements and provisions .................................................. 40
2.5.3 Key terms and concepts .......................................................................... 41
2.5.4 Treatment in the Safety Case .................................................................. 41
2.5.4.1 Methodology ............................................................................................ 41
2.5.5 Lessons learned ...................................................................................... 50
2.6 Sensitivity analysis .................................................................................. 51
2.6.3.1 Methodology ............................................................................................ 53
2.6.4 Lessons learnt ......................................................................................... 63
2.7.2 Regulatory requirements and provisions .................................................. 65
2.7.4.1 Methodology ............................................................................................ 66
2.7.5 Lessons learnt ......................................................................................... 71
2.8 Human intrusion ...................................................................................... 72
2.8.3.1 Methodology ............................................................................................ 73
2.9 Criteria for input and data selection ......................................................... 79
2.9.1 Background ............................................................................................. 80
2.9.4.1 Methodology ............................................................................................ 82
2.9.4.4 On-going work and future evolution ....................................................... 100
2.9.5 Lessons learnt ....................................................................................... 100
in natural claystone ................................................................................ 101
3.1 Protocol for assessing parameter uncertainty ........................................ 109
3.1.1 General procedure and practical considerations .................................... 110
3.1.2 Selection and assessment of a knowledge base.................................... 111
3.1.2.1 Assessment of the quality level of information ....................................... 111
3.1.2.2 Amalgamation of different sources into one data set ............................. 113
VI
3.1.3 Assessment of parameter uncertainty .................................................... 116
3.1.3.1 Consistency ........................................................................................... 116
3.1.3.3 Determination of a PDF from given data ................................................ 118
3.1.4 Algorithmic description of PDF generation ............................................. 121
3.2 Application of different sensitivity analysis methods to a PA
model for a repository in rock salt .......................................................... 124
3.2.1 Modification of the EMOS statistic module for the use of FAST
methods ................................................................................................ 126
3.2.3.2 Time-dependent analysis ....................................................................... 139
4 Safety indicators and performance indicators .................................. 151
4.1 Repository in salt ................................................................................... 151
4.1.1 Reference concept and scenario information ......................................... 152
4.1.2 Safety indicators .................................................................................... 157
4.1.2.2 Radiotoxicity concentration in biosphere water ...................................... 161
4.1.2.3 Power density in groundwater ................................................................ 163
4.1.2.4 Radiotoxicity flux to/from the geosphere ................................................ 169
4.1.2.5 Normalised safety indicators .................................................................. 171
4.1.2.6 Robustness of safety indicators in case of radionuclide release ............ 173
4.1.3 Indicators based on risk ......................................................................... 176
4.1.3.1 Reference values for indicators based on risk ....................................... 180
4.1.3.2 Calculation of risk .................................................................................. 181
4.1.4 Performance indicators .......................................................................... 183
4.1.4.1 Compartment structure .......................................................................... 184
VII
4.1.4.4 Integrated radiotoxicity fluxes from compartments ................................. 188
4.1.5 Summary ............................................................................................... 189
4.2.1 Test case ............................................................................................... 194
4.2.2.1 Enhancements of the CLAYPOS module............................................... 197
4.2.2.2 Radiotoxicity inventories/fluxes in/from different compartments ............. 204
4.2.3 Results from the probabilistic simulations for the dose as safety
indicator ................................................................................................. 212
4.2.3.2 Analysis of the maximum dose rate ....................................................... 214
4.2.3.3 Time-dependent analysis ....................................................................... 219
4.2.4 Results from the probabilistic simulations for radiotoxicity fluxes and
inventories as performance indicators ................................................... 229
4.2.4.1 EFAST analysis ..................................................................................... 229
4.3.1 Safety Indicators .................................................................................... 246
5 Relevance of sophisticated approaches in practical cases ............. 255
5.1 Testing of the PA approaches for selected near-field processes in a
repository in salt .................................................................................... 255
5.1.1.1 Definition of the test cases ..................................................................... 257
5.1.1.2 Results .................................................................................................. 260
5.1.1.3 Conclusions ........................................................................................... 277
5.1.2 Benchmark on brine intrusion into a backfilled drift ................................ 278
5.1.2.1 Test case ............................................................................................... 279
5.1.3.1 Test case ............................................................................................... 298
5.1.3.2 Results .................................................................................................. 300
5.1.3.3 Conclusions ........................................................................................... 305
5.2 Relevance of the complexity of modelling for the far field of a
repository in salt .................................................................................... 306
5.2.1 Test case ............................................................................................... 306
5.2.2.2 2D transport model ................................................................................ 310
5.2.2.3 Abstraction to 1D-model ........................................................................ 317
5.2.3 Conclusions ........................................................................................... 325
5.3 Coupling of the transport code r3t with the geochemical code
Phreeqc ................................................................................................. 327
5.3.2 Salt water intrusion into a Ca-HCO3-water column ................................ 331
5.3.3 Conclusion ............................................................................................. 332
6 References ........................................................................................... 333
A Annex: Example files for the use of the FAST method in EMOS ...... 343
List of figures ....................................................................................... 355
List of tables ........................................................................................ 365
1 Introduction
A comprehensive set of arguments and analyses – represented in a safety case – is
needed to justify that geological disposal of long-lived radioactive waste and spent nu-
clear fuel is safe. One pillar of the safety case is the integrated performance assess-
ment of the repository by numerical methods. This Performance Assessment requires a
powerful and qualified instrument. The approach used for the performance assessment
must meet national regulations on the one hand and should be internationally accepted
on the other hand. Further it must be continuously adapted to the state of the art of sci-
ence and technology. Computer codes used for the assessments must be tested and
verified and be designed for the prerequisites of a real waste repository system.
On the European level the project PAMINA (Performance Assessment methodologies
in application to guide the development of the safety case) was conducted from 2007 to
2009 to improve and harmonise integrated performance assessment methodologies
and tools for various disposal concepts of long-lived radioactive waste and spent nu-
clear fuel in different deep geological environments. PAMINA aimed at providing a
sound methodological and scientific basis for demonstrating the safety of deep geolog-
ical disposal of such wastes, that will be of value to all national radioactive waste man-
agement programmes, regardless of waste type, repository design, and stage, that has
been reached in PA and safety case development.
The following report presents the different contributions of the GRS Braunschweig to
the different tasks of the PAMINA project. On a national level, this work was co-funded
by the Federal Ministry of Economics and Technology (BMWi). Some of the work de-
scribed in the following is presented in a similar way in public PAMINA reports given at
the according sections.
The following chapter gives for selected topics an overview of PA methodologies, tools
and experiences for the German national programme from the point of view of the im-
plementer. The other chapters (3 to 5) present methodological advancements achieved
in different areas, which are
− the treatment and management of uncertainty during PA and safety case develop-
ment (chapter 3),
− the use of safety and performance indicators for repositories in salt and clay (chap-
ter 4) and finally,
2
− the improvement of methods and tools regarding process understanding and con-
ceptualization and the determination of needs for implementing more sophisticated
modelling approaches in PA (chapter 5).
3
2 Overview of methodologies, tools and experiences
During the last decades a very large body of experience regarding safety assessment
of geological repositories of radioactive waste has been generated, both in European
countries and outside of Europe. This experience provides a firm basis for future steps
in national development programmes. In parallel with development activities, a growing
number of formal evaluation processes, including regulatory processes, have been and
are being carried out, generating important guidance for future work. A significant part
of these efforts has been realised under the auspices, and in the framework, of the
programmes of international organisations. A comprehensive review was performed in
the project PAMINA with the objective to assess the state of the art of the methodolo-
gies and approaches needed for the safety assessment of geological repositories, and
to distil the lessons learned from the rich experience accumulated in their development
and application. The following issues have been addressed:
1. Safety indicators and performance/function indicators
2. Safety functions
5. Assessment strategy - Safety Approach
6. Evolution of the repository system
7. Modelling strategy
8. Sensitivity analysis
11. Criteria for input and data selection
The following nine sections of this chapter give the review work of the GRS Braun-
schweig addressing the German radioactive waste disposal programme from the view-
point of the implementer. The overall results of the PAMINA review are presented in
the RTDC1 deliverables /PAM 06, PAM 09, PAM 10/. All the topics share a common
structure including the following areas:
4
− Background/Introduction
− Methodology
− Lessons learnt
Not all areas are addressed in each of the topic. The statements towards the regulatory
requirements are similar for all the topics and are summarised in the following. Addi-
tional comments in each of the topics chapters towards the regulatory requirements are
only given if deviant or supplementary comments have been given to that specific topic.
The German Atomic Energy Act merely requires the safe disposal of radioactive waste.
There is an old German guideline (“safety criteria for the final disposal of radioactive
wastes in a mine”), originating from 1983, which is formally still valid /BMI 83/. Con-
cerning long-term safety, it simply requires that “even after decommissioning radionu-
clides that could reach the biosphere in consequence of non-excludable transport pro-
cesses from a sealed repository must not lead to individual doses exceeding the value
given in the Radiation Protection Ordinance”. This value is 0.3 mSv/yr and is valid for
all nuclear facilities. A supplementary regulation from 1988 defines the time frame for
which the individual dose rate should be evaluated as 10 000 years. The consideration
of other safety indicators is not required, nor are probabilistic criteria defined. There is,
however, a consensus in Germany that the mentioned guideline is outdated and should
be revised soon. A first draft for a new version, proposed by GRS, is currently under in-
tense discussion. It requires the consideration of six indicators with fixed reference val-
ues as well as a probabilistic analysis. This paper is, however, a controversial matter
and will be essentially changed before being accepted by the authorities. Therefore, it
5
is not presented here. Nevertheless, it can be said that the future guideline is very likely
to contain the following regulations:
− the calculated individual effective dose rate must not exceed the reference value of
0.1 mSv/yr,
− several additional safety indicators have to be calculated,
− the time frame for which safety has to be proven is 1 million years or more.
Besides the review performed within the PAMINA project the GRS also followed the
German network for research on the actinide migration in natural claystone from the
long-term safety assessment point of view. This view is given in the final section 2.10 of
this chapter.
2.1 Current status of the German national context regarding repository
projects
According to the Atomic Energy Act /ATG 85/ the German Federal Government has to
ensure the safe disposal of radioactive waste by providing repositories. The legal basis
for licensing of federal installations for the safekeeping and final disposal of radioactive
waste is the "Plan Approval Procedure" required by the Atomic Energy Act. Radioactive
waste disposal policy in Germany is based on the decision that all types of radioactive
waste are to be disposed of in deep geological formations. The currently valid safety
criteria for the final disposal of radioactive waste in a mine dates from 1983 /BMI 83/.
Since then, regulatory expectations have advanced, now reflecting the international
standards set out by ICRP /ICRP 98/, NEA /NEA 04/ and IAEA /IAEA 06/. On this ac-
count, GRS proposed “Safety requirements for the disposal of high active wastes in
deep geological formations” /BAL 07/ on behalf of BMU (Federal Ministry for the Envi-
ronment, Nature Conservation and Nuclear Safety), which is expected to serve as a
sound basis for a new regulation. The BMU is presently elaborating the final version of
the Safety Requirements. A draft version of the Safety Requirements was presented in
November 2008 to the public /BMU 08/.
Prior to 1980 the former iron ore mine Konrad was selected as a site for disposal of
short-lived and long-lived radioactive waste with negligible heat generation and the salt
dome at Gorleben as a site for the disposal of all types of radioactive waste. In the for-
6
mer German Democratic Republic short-lived low- and intermediate-level radioactive
waste was disposed of in the Morsleben repository, a former rock salt and potash mine.
The Konrad repository had been licensed in May 2002. All suits that were filed against
it were rejected by the competent court in 2006. Complaints against the courts decision
were definitely rejected by the Federal Administrative Court in April 2007. Following
necessary planning adjustments the former iron ore mine will be converted into a re-
pository for all kinds of radioactive waste with negligible heat generation by the end of
2013.
The disused salt and potash mine Morsleben (ERAM), located in the Federal State
of Saxony-Anhalt, has been in operation since 1971 as a repository for short-lived low-
and intermediate-level radioactive waste. Disposal was terminated in 1998. A waste
volume of about 37 000 m3 has been disposed of with a total activity of approx.
4.5·1014 Bq. Since 1990, the Morsleben facility has the status of a federal repository.
The license for operating the repository originates from the former German Democratic
Republic and do not include the license for the closure of the repository. Therefore, ac-
cording to the German Atomic Energy Act /ATG 85/ a license application for the closure
of the repository is being prepared by BfS (Federal Office for Radiation Protection).
The Gorleben salt dome in the north-east of Lower Saxony has been investigated for
its suitability to host a repository for all types of solid and solidified radioactive waste for
several decades. However, after the licensing of the Konrad repository the focus is
mainly on heat generating radioactive waste originating from reprocessing and spent
fuel elements. The exploration of the Gorleben salt dome was interrupted on 1st Octo-
ber 2000 according to a moratorium of up to 10 years.
The German radioactive waste management and disposal concept as well as the site
selection process are still under discussion. In terms of the site selection process, a re-
spective concept from BMU was suggested in 2006. This concept includes the exami-
nation whether site alternatives exist in addition to Gorleben, which let expect or pos-
sess a higher level of safety /GAB 08/.
The current R&D concept focuses on all types of host rocks, prioritised in the following
order: rock salt, argillaceous rock, crystalline rock. Concerning rock salt, which has
been the preferred option in Germany for several decades, the technical and engineer-
ing know how as well as the scientific expertise are considered well advanced and are
7
now available for the conceptual design of a high level waste repository. During the last
10 to 15 years suitable analytical tools have been continuously developed according to
the world wide advancing state-of-the-art. They are ready to be tested and applied at
appropriate and concrete cases. For repositories in argillaceous and crystalline rock
R&D work focussing mainly on mechanical and hydraulic properties of the engineered
and the geological barriers has been performed during the last decade. System models
for an integrated safety assessment are available for both formations.
2.2 Safety indicators and performance/function indicators
2.2.1 Background/Introduction
Although, of course, measures for quantifying the results of performance assessment
calculations, mainly dose and risk, were always in use, it is a relatively new concept to
improve the understanding of the system and to support the safety case by using com-
plementary indicators. Such indicators are calculable quantities resulting from a PA
calculation. While safety indicators aim at providing a quantitative criterion for the over-
all safety of a repository system, other indicators are calculated and presented to show
the functioning of the system or specific components. They are sometimes called ‘per-
formance indicators’ or ‘function indicators’, but they differ, with respect to goals and in-
tention, from what SKB calls ‘safety function indicators’. It is therefore suggested, in or-
der to avoid confusion, to use the term ‘function indicator’ only in the latter sense as a
short form. In this paper, the term ‘performance indicator’ is used.
In former German safety assessment studies, the only safety indicator used was the
individual ingestion dose per year, compared to a regulatory limit. The SPIN project
/BEC 03/ was initiated by a new way of thinking, based on the awareness that the ro-
bustness of the safety case could be improved by using more than one safety indicator,
as well as performance indicators. Several safety and performance indicators were
tested in SPIN, using four national granite studies as examples.
In 2004, a detailed performance assessment for the Morsleben LAW repository
(ERAM), which is installed in a former salt mine, was performed. The safety indicators
defined in SPIN, as well as some performance indicators, were successfully applied to
support the safety statement. It has become clear in this exercise that a rock salt re-
pository requires performance indicators that differ from those used for granite, while
8
safety indicators, though possibly depending on local reference values, are independ-
ent of the site and formation type.
The concepts and understanding of safety and performance indicators have further
evolved since the end of SPIN. Presently, a new study for a HLW/SF repository in salt,
called ISIBEL, is being made. Several safety and performance indicators were or will
be calculated and compared with one another. This is done in parallel to PAMINA and
the new concepts and ideas developed.
2.2.2 Key terms and concepts
In the following, the concept of safety and performance indicators as it is understood by
GRS (Braunschweig) is described. Since the subject is under intense discussion in
Germany at present, the following should neither be seen as ‘the German standpoint’,
nor should it be regarded as final.
Safety indicators
Repositories for radioactive waste must be proven to be safe in the long-term. But what
does that mean? A very general definition of repository safety can be given in the fol-
lowing way:
A repository is safe if it does not significantly change or disturb the natural evolution of
the environment outside a narrowly limited area of influence.
Safety, in this sense, cannot be reduced to one single aspect like human health, but
comprises a nearly unlimited variety of protection goals like water quality, air quality,
protection of species, etc. There can, of course, be overlap between such protection
goals, or one goal can completely include another one, but the often-heard statement
that protection of man comprises all other protection goals cannot be proven.
A numerical calculation of the dissemination of radionuclides from a repository yields,
in general, radionuclide fluxes. These results are per se not suitable for assessing the
long-term safety of the repository, as they give no information about whether or not the
repository can be considered ‘safe’ as defined above. It is necessary to convert the re-
sults into some safety-related measure, or safety measure. ‘Safety-related’ means that
the safety measure should quantify a specific aspect of repository safety.
9
The word ‘significantly’ in the definition above does allow a certain influence of the re-
pository on the environment if it is very small and negligible in comparison with natural
influences. If safety with respect to some specific aspect is to be assessed using a
safety measure, it is necessary to quantify a reference value as the limit of acceptability
with respect to the safety aspect under consideration. Reference values should be
proven to maintain the protection goal.
It is possible that different safety aspects (or protection goals) can be quantified with
the same safety measure, using different reference values. Therefore, only the combi-
nation of a safety measure and a suitable, safety related reference value, both related
to the same protection goal, is appropriate to give an indication of safety of the reposi-
tory and is called a safety indicator. A safety indicator should always take account of
the effects of all radionuclides in the repository.
There are two kinds of safety indicators. Those of the first kind are calculated for spe-
cific scenarios and the results can be compared in order to assess the consequences
of different scenarios. Safety indicators of the second kind, however, are summed up
over all relevant scenarios, each weighted by its probability. Such indicators are prefer-
ably calculated in terms of risk. They can be compared with risks from daily life or from
natural sources like earthquakes, meteorite impacts, etc. The main problem with risk
indicators is that scenario probabilities can, in most cases, only be roughly estimated.
For performing a safety assessment it is always necessary to use at least one safety
indicator. The technique mostly applied in the past is to calculate the time-evolution of
the annual ingestion dose to an individual or a group and to compare it with a regulato-
ry limit. The protection goal underlying this safety indicator is human health and the
reference value was, though fixed by a regulatory rule, originally derived from the de-
mand to be negligible compared to the natural background. In Germany, a value of
0.3 mSv/yr has been used so far. This safety indicator is widely used and refers to a ra-
ther universal protection goal, but it depends on more or less uncertain assumptions
about the geosphere and biosphere. Moreover, it could suggest covering all aspects of
safety, while actually it does not. Therefore, it is regarded increasingly necessary to
consider additional safety indicators.
Performance indicators
Safety indicators are a good means to assess the overall safety of a repository system,
but they do not yield detailed information about the functioning of the system. Such in-
formation, however, can be very helpful or even necessary in the process of concept
development. It can be gained by using performance indicators.
A performance indicator is a calculable measure for the performance of parts of the
system. These parts, which are called compartments, can be things like single barriers,
groups of barriers, emplacement fields, the complete near field, or even the total sys-
tem. Compartments can include others. The compartment structure to be used for a
specific repository system should be a sensibly simplified image of the real system
structure and depends on the type of the repository.
Performance indicators should illustrate how the repository works. Radionuclide fluxes
between or concentrations in the compartments, e. g., show how and where the radio-
nuclides are retained during the transport through the system. The time-evolution of a
performance indicator should be calculated and compared for different locations, but a
comparison with an absolute value is normally not necessary.
Whereas a safety indicator always requires considering of all relevant radionuclides in
order to derive a safety statement, a performance indicator can be calculated for a sin-
gle radionuclide, a group of radionuclides or the total radionuclide spectrum, depending
on what is to be demonstrated. In this way it is possible, e. g., to compare the system
performance for sorbing and non-sorbing species, or for the uranium and the thorium
chain.
2.2.3 Treatment in the safety case
This section describes which indicators have been used by GRS in the past, and why.
It is pointed out how the indicators have been calculated and interpreted and which ref-
erence values were used.
2.2.3.1 Methodology
Safety indicators
According to the regulations mentioned above, in all German studies made before
2000, only the individual effective dose rate was calculated and compared with the limit
of 0.3 mSv/yr, normally for different concepts or different scenarios. Additional numeri-
cal investigations were, in some cases, performed in order to explain the results, but
not to derive independent safety statements. In contrast to what the valid guidelines re-
quire, however, the calculations were always executed over a model time of at least 1
million years.
The SPIN project (2000 – 2002) has triggered a new view of the problem. The three
safety indicators identified in SPIN to be useful have been applied in two recent studies
for real sites:
− ERAM: The long-term safety assessment study for the LAW repository in rock salt
near Morsleben,
− Asse: The long-term safety assessment study for the experimental LAW/MAW re-
pository Asse in rock salt near Wolfenbüttel.
Moreover, five of the six indicators defined in the GRS proposal for a new guideline
have recently been calculated in the ISIBEL study which considers a generic HAW re-
pository in rock salt. This, however, is a running project, and the indicators themselves
are still under discussion at GRS. Therefore, the results and findings of this exercise
are not presented here.
In the following, the application of the SPIN safety indicators in the ERAM study is ex-
plained more detailed.
The primary safety indicator evaluated in the study is, according to the regulations
mentioned above, still the effective dose rate to an adult human individual, in combina-
tion with the regulatory reference value of 0.3 mSv/yr. It has been calculated as a func-
tion of time over 1 million years, using standardised biosphere dose conversion factors.
12
These dose conversion factors have been defined by GSF considering a number of
typical exposure paths, which comprise:
− ingestion of drinking water,
− inhalation of contaminated particles,
− exposure by external radiation.
Since these paths refer to the present human population, the dose conversions factors
are increasingly uncertain for longer time frames.
There was no freedom about the reference value, but since it is about 10 % of the natu-
ral radiation exposure, the repository is considered to be safe if the additional radiation
exposure originating from it remains below this limit. For the ERAM reference scenario,
the maximum dose rate is more than three orders of magnitude below the reference
value.
Two more safety indicators have been considered. The radiotoxicity concentration in
the aquifer has been calculated using the ingestion dose coefficients by ICRP. This
measure is more robust than the dose rate because it is independent of the biosphere,
though it is still based on the radiosensitivity of present-day humans. There is no “offi-
cial” reference value for this measure, but it is rather easy to determine one. Waters
that have been drunk by humans for hundreds of years without causing harm can be
considered radiologically safe. There are a lot of data about concentrations of radionu-
clides in German drinking waters, and a typical radiotoxicity concentration of
7.7 µSv/m³ could be derived. With this reference value the radiotoxicity concentration
becomes a proper safety indicator. It has been found that for the ERAM reference sce-
nario the maximum radioxicity concentration in the aquifer is a little more than three or-
ders of magnitude below this reference value.
The third safety indicator considered is based on the radiotoxicity flux from the reposi-
tory. This is an even more robust measure than the aquifer concentration because it is
independent of the geosphere, which could be influenced by ice ages etc. The problem
13
with this measure is to find a clearly safety-related reference value. Two different pos-
sibilities were discussed. One is the natural radiotoxicity flux in a river near the reposi-
tory, which is likely to finally collect all radionuclides released from there. The other
possibility is the natural flux of raditoxicity in the groundwater near the repository. It was
found that the second value was about three orders of magnitude lower than the first
one. This is an example for the argument that one single safety measure can yield dif-
ferent and independent safety indicators if compared with different reference values. If
the first value is used, the safety statement will be, “there is no significant influence on
the river”, which could be relevant for the river fauna and is clearly a safety aspect. If,
however, the groundwater flux is used as reference value, the safety statement will be,
“there is no significant influence on the groundwater”, which is a different and probably
more relevant safety aspect. By this reason, and because the value is lower, it was de-
cided only to consider the natural radiotoxicity flux in groundwater as reference value,
though it was harder to determine and is considered less robust. It was found to be
0.2 Sv/yr. For the ERAM reference scenario the maximum radiotoxicity flux from the
repository is a bit more than three orders of magnitude below this reference value.
Performance indicators
In order to investigate the functioning of the repository system in detail, several perfor-
mance indicators have been calculated for the ERAM reference scenario. The com-
partment structure used for this purpose is based on the model structure which is a
strong simplification of the real mine structure. There are three sealed emplacement
areas, two non-sealed emplacement areas and a number of voids that have not been
used for emplacement purposes and are called ‘residual mine’. Depending on the spe-
cific requirements of the investigations, the performance indicators have been calculat-
ed for slightly different compartment structures, sometimes merging the non-sealed
emplacement fields together with the residual mine, sometimes not. It has become
clear that, unlike a granite repository as considered in SPIN, a rock salt repository, es-
pecially if erected in an abandoned production mine, does not allow a unique and hier-
archical compartment structure.
In order to show the dissemination of radionuclides within the mine, the concentration
of radiotoxicity in the different compartments has been calculated as a function of time.
To distinguish between the influences of the different emplacement fields, three differ-
ent investigations were performed, one considering the total inventory, one considering
only the inventory of the sealed emplacement areas, and one considering only the in-
14
ventory of the non-sealed emplacement areas. It could be showed that the sealed em-
placement areas, though the seals are assumed to lose their effectiveness after about
20 000 years, still contain 90 % of that part of their inventory that has not decayed after
1 million years. Even the non-sealed emplacement areas hold the main part of their in-
ventory for about 100 000 years.
As an additional performance indicator the integrated radiotoxicity flux from the com-
partments was calculated as a function of time, each normalised to the initial inventory
of the appropriate compartment. As already detected in SPIN, this is a very illustrative
indicator since the time curves reach asymptotic values and the comparison of these
shows how much of the inventory is finally retained in each compartment. The results
show that a part of less than 0.1 % of the inventory of the sealed emplacement areas
leaves these and even from the worst of the non-sealed emplacement areas only 10 %
of its inventory can escape. A part of 10-5 of the total inventory leaves the repository
system and reaches the biosphere.
2.2.3.2 Related topics
The issue of safety and performance indicators is related to a number of other topics:
− assessment strategy,
− safety approach,
− safety functions,
− biosphere,
− sensitivity analysis.
2.2.3.3 Databases and tools
Reference data are of high importance for safety indicators and should be taken from
environmental measurements, biological investigations, etc. Some of the available data
15
needed for determination of reference values are rather incomplete and uncertain. This
problem might make it hard to apply or even test some promising indicators.
The tools needed for calculating safety and performance indicators are the same that
are being used for conventional performance assessment calculations, with a few slight
modifications or add-ons.
2.2.3.4 Application and experience
In the ERAM study three safety indicators were applied as described in section 4.1.
The time-curves are similar in shape because they have been derived from the same
calculations, but nevertheless yield independent safety statements since the reference
values have been determined completely independently and with totally different as-
sumptions. It is interesting to see that even so all three safety indicators yield nearly
exactly the same gap of about three orders of magnitude between the maximum and
the reference value. This is clearly a coincidence but it shows a certain robustness of
the safety assessment. For the ERAM reference case, the results are shown in figure
2.1 in units relative to the respective reference value. In this representation the three
curves are very close to each other.
Time [years]
R el
at iv
e U
ni ts
10-6
10-5
10-4
10-3
10-2
10-1
100
Radiotoxicity concentration in groundwater / 7.7 µSv/m³ Radiotoxicity flow in groundwater / 0.2 Sv/a Individual dose rate / 0.3 mSv/a
Fig. 2.1 Three safety indicators, calculated for the ERAM reference case
16
A very illustrative performance indicator is the time-integrated radiotoxicity flow from
different compartments of the repository, related to the initial inventory of the compart-
ment. The curves finally reach stationary values which show how much of the initial in-
ventory leaves the compartment. For the ERAM case, this indicator has been calculat-
ed for five compartments, three of them being separated emplacement areas plus the
complete mine and the total system including the geosphere. The results are shown in
figure 2.2. It can bee seen that even the worst (and non-sealed) emplacement area,
which is not designed to retain anything at all, nevertheless retains nearly 90 % of its
inventory and the total system releases only about ten millionths of the initial radiotoxi-
city.
10-6
10-5
10-4
10-3
10-2
10-1
100
WSF (emplcement area) ZT (emplacement area) NF (emplacement area) Mine Total system
Fig. 2.2 Time-integrated radiotoxicity fluxes from different compartments of the
ERAM repository (reference case; each curve is related to the initial in-
ventory of the respective compartment)
2.2.3.5 On-going work and future evolution
Currently, different safety and performance indicators are being calculated within the
new ISIBEL study for a HLW/SF repository in rock salt. Within PAMINA a wider variety
of indicators including those of the risk type is tested. It is also planned to perform
17
probabilistic analyses in order to identify the specific sensitivities of different safety and
performance indicators.
2.2.4 Lessons learnt
The application of different safety indicators does only make sense if they aim at differ-
ent safety aspects and provide different and independent safety statements. A safety
statement depends not only on the safety measure but also on the reference value. For
a safety indicator to be robust it is necessary that neither the safety measure nor the
reference value depend on uncertain data or assumptions. Therefore, the radiotoxicity
flux from the repository can only be considered robust and adequate for long time-
frames if combined with a robust and safety-related reference value, which is not easy
to find. Establishing of reference values is a very important and sometimes difficult
task. A good reference value should be provably safe and valid for a long or at least
well-known time frame. Reference values can be global or site-specific. A safety indica-
tor can never be better than its reference value.
So far, only safety indicators that aim at human health have been considered in actual
studies in Germany. Other protection goals like protection of non-human biota or even
the inanimate environment should be taken into account. Some of the indicators con-
sidered in ISIBEL are of a more general character and could be adequate for such a
concept.
Since the number of possible protection goals is nearly unlimited, a classification of
such goals with a hierarchical structure could be a sensible task. It should be tried to
find a limited number of protection goals that cover large ranges of others, ideally the
total field of ‘safety’. This could help defining a limited but comprehensive set of safety
indicators.
Safety indicators of the risk type have not been considered so far in German studies.
The reason might be that scenario probabilities are hard to determine. This kind of indi-
cators can, however, be very illustrative and helpful in communicating with the public
and should therefore be tested.
Performance indicators are always helpful to better understand the functioning of the
system. They should be defined specifically for each study. As already seen in SPIN, it
18
is hard to give a general recommendation for the use of performance indicators. It can,
however, be said that integrated fluxes from different compartments, if interpreted cor-
rectly, in many cases provide very illustrative and useful information.
2.3 Uncertainty management and uncertainty analysis
2.3.1 Background/Introduction
There are two basically different ways to handle uncertainties. One is using conserva-
tive models and parameter values instead of realistic ones, making sure that the reality
cannot be worse than the calculated results. The other possibility is to establish proba-
bility distributions for all uncertain parameters and to perform a probabilistic analysis
with a big number of separate runs. The first approach can cause some problems as
conservativity is sometimes hard to prove. Moreover, too much conservativity can re-
sult in a failure of the proof of safety. Probabilistic analysis is always to be preferred, as
it allows for an assessment of the probability of a failure, as long as the uncertainties of
models and input parameter can be properly quantified. This, however, is not always
possible. Therefore, normally, both approaches are combined by using conservative
models and parameters only where the uncertainty is hard to quantify, and then per-
forming a probabilistic analysis.
Probabilistic uncertainty analysis, though not required by valid regulations, is a com-
mon means for assessing the outcome of a repository model and has been in use in
Germany for more than twenty years. The procedure was performed already in 1988 in
the PAGIS study for a HLW/SF repository in rock salt and is described in the report
/STO 88/. In later studies it was applied in the same form and using the same tools up
to now, recently for the LAW repository near Morsleben (ERAM) and the experimental
LAW/MAW repository in the salt mine Asse near Wolfenbüttel. The methodology for
uncertainty assessment is approved. The main problems lie in identifying the essential
uncertainties, finding the adequate probability distribution functions and correct inter-
pretation of the results.
In the following, the general problem of uncertainties in long-term safety assessments
is described as it is seen by GRS (Braunschweig).
Aleatory and epistemic uncertainties
Basically, it can be distinguished between two different kinds of uncertainties which re-
quire their specific handling: Uncertainties that are due to physical imponderabilities or
principally unforeseeable processes are called aleatory; uncertainties, however, that
originate from our lack of knowledge about the nature are called epistemic. Epistemic
uncertainties are those of physical parameters that are only insufficiently known. Such
uncertainties can be principally reduced by additional measurements, improvement of
measurement techniques or other investigations. Aleatory uncertainties, however, can
neither be avoided nor reduced and have simply to be accepted as they are. An exam-
ple for an aleatory uncertainty is the time of failure of a single canister. This depends
on things like pitting corrosion due to the existence of microscopic fissures in the con-
tainer material from the fabrication process or from mechanical impacts during the em-
placement. Of course, one can argue that it is possible to reduce this uncertainty by op-
timising the canister fabrication and handling processes, but such measures would
change the system itself and not simply the knowledge about it.
The adequate handling of uncertainties depends on their type. Aleatory uncertainties
should be quantified as exactly as possible and their influence on the uncertainty of the
results should be analysed. This uncertainty has to be accepted and taken into account
in the safety case. A sensitivity analysis normally makes little sense for parameters that
are subject to aleatory uncertainties. In contrast to this, if applied to epistemically un-
certain parameters, sensitivity analysis can identify those parameters that should be
analysed or measured more thoroughly in order to reduce their uncertainty.
In the practice of long-term safety assessments for final repositories, there are very
few, if any at all, purely aleatory uncertainties. Most uncertainties are a mixture of both
types, since there are random influences as well as lack of knowledge. The epistemic
character, however, is dominant in most cases, and if it is not, like in the mentioned ex-
ample of the canister failure time, it can nevertheless make sense to treat the uncer-
tainty as if it were epistemic. The reason has been indicated above: Normally, there are
possibilities to reduce even aleatory uncertainties by technical or constructional
20
measures, and it might be helpful to identify influential parameters by sensitivity analy-
sis. Therefore, GRS decided not to distinguish between aleatory and epistemic uncer-
tainties and to treat all uncertainties as epistemic ones.
Kinds of uncertainties
The most important uncertainties in long-term safety assessment are parameter uncer-
tainties. As explained above, it is always assumed that these uncertainties are epistem-
ic, i. e. due to insufficient knowledge about the actual natural conditions. Parameter un-
certainties can origin from poorly known properties of the host rock, unclear flow
conditions inside the mine, lack of knowledge about chemical conditions, etc. Parame-
ter uncertainties are relatively easy to handle because they correspond directly with
quantifiable numerical uncertainties. In many cases, a conservative value can be given,
but this is only possible if the influence of the parameter to the result is monotonic.
Another kind of uncertainties is model uncertainties. In some cases, it is not clear which
model has to be applied to describe a specific effect. Such uncertainties can be due to
improper physical knowledge of the process, insufficient accuracy of the available
models, or the inability to predict the correct physical situation. Model uncertainties are
also always assumed to be epistemic. They are more difficult to handle than parameter
uncertainties as they are hard to quantify. Where it is possible to specify a conservative
model, this is the most convenient approach. If, however, there is no model that can be
proved to be conservative, the model uncertainty can be mapped to an artificial param-
eter with discrete values, each representing one of the possible models. This parame-
ter can be treated like a normal uncertain parameter in a probabilistic analysis.
Scenario uncertainties are the third kind of important uncertainties in long-term safety
assessments. Normally, a number of different scenarios are developed which are con-
sidered more or less probable. Scenarios are derived from a FEP (features, events,
processes) analysis and comprise things like the temporal evolution of the near field,
transport through the far field and exposition paths in the biosphere. Since the probabil-
ities of many FEPs can only roughly be estimated, scenario probabilities are very un-
certain. The usual method to handle these uncertainties is investigating several scenar-
ios independently, including a worst-case scenario and a scenario that is assumed to
represent the intended evolution. Another possibility is to calculate risks which include
contributions from all scenarios, but this requires a proper knowledge of the scenario
probabilities.
21
2.3.3.1 Methodology
This section describes how uncertainties have been handled within the long-term safe-
ty assessment studies of GRS (Braunschweig). The general procedure has been basi-
cally the same for more than 20 years. The examples in the following are taken from
the ERAM study for the LAW repository in an abandoned salt production mine near
Morsleben. This is one of the most recent and most detailed studies by GRS.
Scenario uncertainties have been treated, as mentioned above, by investigating a nor-
mal evolution scenario, a worst-case scenario, and a limited number of additional sce-
narios that appear interesting by some reason. A quantification of scenario probabilities
and calculation of risks has never been performed so far. Model uncertainties have
mainly been handled by using conservative models. In some cases, however, model al-
ternatives have been switched by use of artificial parameters as described above. In
such cases, the model uncertainty is mapped to a parameter uncertainty and can be
treated in the same way. Therefore, in the following only parameter uncertainties are
considered.
Identification of uncertain parameters
Not all parameters in a safety assessment are uncertain. Geometrical dimensions of
containers, distances in the mine building or well-known material constants like the
mass density belong to the parameters that are more or less exactly known. Others
may be less well-known, but are likely to have little influence on the results and can al-
so be considered certain. In cases of doubt the value is chosen conservatively. In the
ERAM study examples of such parameters are the void volumes in the different levels
of the mine, or the radionuclide inventories, which have been collected over decades
and can in some cases only be estimated.
The number of parameters that are really treated as uncertain should be kept limited, in
order to allow a manageable uncertainty analysis. If for parameter a clearly conserva-
tive value can be given that is not too far away from the most probable value, are pref-
erably simply assumed to be certain. Particularly those parameters that are suspected
to have a nonlinear or unclear influence on the calculation results are selected for an
22
uncertainty analysis. In the ERAM study, these are 43 parameters, comprising things
like global and local convergence rates, reference porosity, corrosion rates, gas entry
pressure, initial permeabilities of seals, distribution coefficients and diffusion constants.
Bandwidths and probability distribution functions
Each uncertain parameter has to be assigned a bandwidth interval. This can be a diffi-
cult task, as, if chosen too small, the bandwidth does not come up to the real uncertain-
ty and, if chosen too big, it could jeopardise the proof of safety. Therefore, the interval
boundaries have to be fixed carefully and with as much expertise as possible.
The next step is defining a probability distribution function (pdf) for each uncertain pa-
rameter. There is no unique procedure for this task. So far, mainly three types of distri-
butions have been used:
− Uniform distribution: If a parameter is known (or suspected) to lie anywhere be-
tween the boundaries with no preferred value, a uniform distribution is applied. In
some cases the interval is divided into sub-intervals with different but constant
probabilities. This is sometimes called a histogram distribution.
− Triangular distribution: If the parameter has a clearly preferred value within its in-
terval but no other information is available, a triangular distribution should be cho-
sen. It can be symmetric or asymmetric.
− Normal distribution: If a preferred value and a typical deviation is known, a normal
distribution should be chosen. From a mathematical point of view, a normal distri-
bution extends to infinity on both sides, which is physically doubtful and numerically
problematic. Therefore, an interval is defined also for these parameters and the
distribution must be cut at the boundaries. Sometimes, it seems plausible to
choose a normal distribution within a given interval around some mean value but
the standard deviation is unknown. In this case, the standard deviation has to be
calculated from the interval boundaries. It is common practice to take the bounda-
ries as the 0.001- and 0.999- quantiles of the distribution, which corresponds to a
bandwidth of 3.09 times the standard deviation to both sides of the mean. This is
unchangeably fixed in the EMOS code package, which has been used for all GRS
studies. Therefore, it is neither possible to choose an asymmetric normal distribu-
tion nor to define the interval boundaries and the standard deviation independently.
23
All distribution types, except the triangular distribution, can be applied either on a linear
or on a logarithmic scale. If the interval spans more than one order of magnitude, a
logarithmical distribution is preferred. This pertains to parameters like diffusion con-
stants, distribution coefficients or permeabilities. If the interval is smaller than one order
of magnitude, normally a linear distribution is adequate.
Deterministic parameter variations
In the normal procedure of a safety assessment study a reference case is defined for
each scenario under consideration. Every parameter is assigned a reference value
within its bandwidth interval, which is either considered the most probable value or a
slightly conservative one. The first exercise to investigate the influence of the uncer-
tainty of a parameter is a deterministic parameter variation. The parameter is varied be-
tween several discrete values within its bandwidth interval, normally the boundaries
possibly a few additional values, while all other parameters are kept on their reference
value. Comparing the results with those of the reference case and interpreting the dif-
ferences in detail often yields valuable information about the influence of the parame-
ter. This information, however, has a qualitative character und must not be misinter-
preted. If the results hardly change under variation of a specific parameter, this does
not necessarily mean that the parameter generally has little influence. The observed
behaviour can be due to the specific situation that results from the reference values of
the other parameters and can be totally different for another combination of values.
The variation of a single parameter, keeping all others constant, is called a local pa-
rameter variation. The word ‘local’ does not mean that the variation is very small but re-
fers to the fact that only one of the parameters is considered.
Probabilistic uncertainty analysis
For a quantitative determination of the uncertainty of the result of a model calculation, a
probabilistic uncertainty analysis must be performed, varying all parameters within their
bandwidths and regarding their pdfs at the same time. The model is run for a number of
times, each with a new set of parameter values. A complete set of n parameter value
sets is called a sample of size n.
The necessary sample size can be derived from accuracy requirements. In Germany,
there is no official regulation so far, but criteria of 90/90, 95/95 or 99/90 are discussed.
24
The first of these numbers specifies the minimum percentage of adherence to some
safety criterion normally given in form of a limit; the second number is the statistical re-
liability of this statement in percent. A criterion of this type specifies the admissible
number of limit exceedings, but does not say anything about the acceptable amount by
which the limit is exceeded. It can be shown that, if the sample is randomly chosen and
all calculated results remain below the limit, a sample size of 22, 59, or 230 is sufficient
to prove the 90/90, 95/95 or 99/90 criterion, respectively. This does not depend on the
number of parameters. The actual number of runs, however, has been essentially
higher in most studies.
There are different sampling strategies. GRS has most often used a random sampling
strategy because it guarantees a statistical independence of the parameter values,
which is often required by the mathematics. Intended parameter correlations can be
taken into account as well in the sampling as in the evaluation. In some older studies
Latin Hypercube Sampling (LHS) was applied, which allows a better covering of the to-
tal bandwidth of each parameter.
For evaluating the results and assessing the uncertainty of a model calculation, several
statistical measures like mean, median or maximum are calculated. This can either be
done for the absolute maxima of all runs or a specifically interesting point in time. If cal-
culated in small steps for the total model time, the statistical values can be plotted as
time curves. Another curve that is valuable for the uncertainty analysis and has always
been plotted in GRS studies is the Complementary Cumulative Distribution Function
(CCDF). It represents the relative frequency of runs with absolute maxima above some
value versus this value. Typically, this curve has an s-shape, starting at 1 with a rela-
tively steep decrease in the middle region and a flat tail at the end, finally reaching 0. It
allows a much better assessment of the adherence to some limit than a simple statisti-
cal criterion like those mentioned above. Very useful information can also be gained
from scatterplots with one dot for every run, each showing the maximum value and the
time of its occurrence. These plots show, on the first sight, the highest maxima as well
as the most critical time intervals. Additional interesting information can be extracted if
the dots are coloured according to some properties of interest. In the ERAM study, the
dots have been coloured after the radionuclide responsible for the absolute maximum.
The plots show very clearly which radionuclides are responsible for the earliest, the lat-
est, the highest, and the most maxima for each scenario.
25
Sensitivity analysis is an own topic, but since probabilistic sensitivity analysis is closely
related with uncertainty analysis it is briefly addressed here.
On the basis of a probabilistic set of calculations a global sensitivity analysis can be
performed, meaning that the sensitivity of the calculation result to individual parameters
under consideration of the influences of all others is investigated. A sensitivity analysis
requires a much higher sample size than an uncertainty analysis. On the other hand,
the sample size is limited by the computing time. By this reason, in older studies the
sample size was typically a few hundred, while in the ERAM study it was chosen to be
2 000. Generally spoken, the sensitivity analysis is the more accurate, the bigger the
sample is.
There are a number of different methods for probabilistic sensitivity analysis. One sim-
ple approach, named after Pearson, is to calculate the correlation coefficients between
the output of the model and each individual input parameter. The higher the absolute
value of the correlation coefficient is, the higher is the sensitivity to the respective pa-
rameter. A positive coefficient means that the result increases if the parameter does so,
a negative value indicates an inverse correlation. Another technique is performing a
linear regression and determining regression coefficients for each parameter. A high
regression coefficient means a high influence of the parameter to the result. There are
some more similar, but more sophisticated, methods. All these methods are linear,
which means that they work best for linear systems. Since, however, the models for fi-
nal repositories are typically very complex and non-linear, the use of these methods is
limited. A possibility of improving their significance is to perform a rank transformation.
This means that each parameter value as well as the output value is replaced by its
rank in the ordered list of all values in the sample. The rank transformation makes
many models, at least monotonic ones, closer to linear, but at the cost of losing the
quantitative relevance of the results. So far, GRS (Braunschweig) has always per-
formed a rank transformation in sensitivity analysis studies.
A somewhat different approach to sensitivity analysis is two-sample tests like the
Smirnov test. The sample values of the parameter under consideration are divided in
two groups, one containing the upper 10 %, the other the rest. If there is a significant
difference between the results obtained with the two groups, the parameter is consid-
ered important.
tracted attention. Such methods use the statistical variance for calculating sensitivity
measures that do not require linearity or monotonicity of the model and can be quanti-
tatively interpreted, but need high sample sizes. The most general theory was given by
Sobol, but the technique proposed by him is complicated and computational expensive.
A more practical approach is the Fourier Amplitude Sensitivity Test (FAST), which is
based on the idea to scan the parameter space periodically with individual frequencies
for each parameter, and to recover the frequencies in the model output value by means
of a Fourier analysis. It can be shown that the sensitivity measures calculated with
FAST are the same as those proposed by Smirnov. The FAST method has not yet
been applied by GRS in practical studies, but it has been tested for demonstration pur-
poses. It could be shown that the FAST technique works and can yield valuable addi-
tional information, compared with a linear sensitivity analysis.
Linear as well as variance-based sensitivity analysis can be performed with the soft-
ware tool SIMLAB which is planned to replace the statistical components of the EMOS
package in future.
2.3.3.2 Related topics
The issue of uncertainty management is related to a number of other topics:
− the assessment strategy,
− the safety approach,
− definition and assessment of scenarios,
− safety indicators and performance/function indicators,
− sensitivity analysis,
− modelling strategy,
27
2.3.3.3 Databases and tools
The EMOS code package used for the GRS studies automatically calculates three lin-
ear sensitivity measures on a rank basis (Spearman rank correlation, partial rank corre-
lation, standardised rank regression), and the Smirnov test. The methods are applied to
the maximum value as well as to a number of points in time that may appear interest-
ing. The parameters are ranked after the calculated significance for each method, and
then an average ranking is calculated.
Linear as well as variance-based sensitivity analysis can be performed with the soft-
ware tool SIMLAB which is planned to replace the statistical components of the EMOS
package in future.
2.3.3.4 Application and experience
The results of uncertainty analysis are usually presented in different forms. In all Ger-
man studies performed in the past, the complementary cumulated density function
(CCDF) for the maximum was plotted. That means that the maximum output values of
all runs, regardless of their time of occurrence, are evaluated together. The cumulated
frequency of maxima above some value is plotted against this value. This results typi-
cally in an s-shaped curve starting at 1 for very low output values and ending at 0 for
very high ones. Another method of presentation is a histogram plot directly showing the
frequencies of maxima lying in specific intervals. Both diagrams are shown together
exemplarily for the ERAM study in figure 2.3. It can be seen that two of 2 000 runs yield
maxima slightly above the limit.
28
2
4
6
20
40
60
80
100
Limit
Fig. 2.3 Complementary cumulative density function (CCDF) and frequency den-
sity for the ERAM study (2 000 runs)
A very illustrative way of presenting the results of a probabilistic analysis is shown in
figure 2.4 for the ERAM study. The absolute maxima of all runs are plotted in a scatter
diagram versus the time of their occurrence. Additional information is provided by col-
our-coding the radionuclides that are responsible for the respective maxima. Only five
different radionuclides appear in the diagram. The earliest maxima occur after a few
hundred years and are caused by 90Sr or 137Cs, which are relatively short-lived. These
maxima are due to the extremely pessimistic assumption that the whole mine is flooded
instantaneously after repository closure. The most maxima are caused by 126Sn and
remain well below the limit of 3·10-4 Sv/yr. At medium times there are some maxima
caused by 14C, at very late times 226Ra as a decay product of 238U becomes dominant.
A few maxima at medium times are caused by 226Ra from the inventory.
29
10-8
10-7
10-6
10-5
10-4
10-3
10-2
limit
2.3.3.5 On-going work and future evolution
It is planned to create a basis for a more systematic uncertainty management. This
comprises unique rules for establishing appropriate probability distribution functions
according to the degree of knowledge, as well as applying standardised criteria for
evaluation of the results.
2.3.4 Lessons learnt
Uncertainties can be managed by using conservative models or values or by probabil-
istic methods. Both approaches should be applied as they complement one another. A
probabilistic uncertainty analysis should always be performed since it is the only possi-
bility to provide quantitative measures that can be checked against formal criteria. The
sample size has to be oriented at the formal criteria to be held, as well as the require-
ments of the methods to be applied.
A sensitivity analysis is a very useful supplement to a pure uncertainty analysis and
should always be performed. Deterministic parameter variations help understanding
the system behaviour and provide a qualitative local sensitivity analysis. A global sensi-
30
tivity analysis requires probabilistic techniques and should be performed in combination
with the uncertainty analysis.
The methods for defining bandwidths and pdfs are not very systematic so far. Often
they are defined by a quick expert guess. This is not satisfying. There should be a clear
and transparent procedure which leads to a unique bandwidth and pdf under consider-
ation of all available knowledge. The development and testing of such a procedure is a
task of the next years.
The linear methods of sensitivity analysis, which have been applied exclusively so far,
seem to be insufficient to analyse the system behaviour correctly. It is possible that
they yield even misleading results. Therefore, variance-based methods should be test-
ed in detail, the more as the computational powers of modern hardware allow increas-
ingly big sample sizes. It has been showed that such methods can yield some added
value. There is, however, no experience so far about necessary sample sizes or specif-
ic problems like the considering of statistical parameter correlations.
2.4 Evolution of the repository system
2.4.1 Background
This document describes the approaches applied by GRS-B for analysing and imple-
menting the evolution of the repository system in performance assessment (PA) model-
ling for the disposal of high level waste (HLW) and spent fuel in salt rock formations in
Northern Germany. This document deals neither with the evolution of repositories for
intermediate level waste (ILW) nor repositories for other host rock types such as clay or
granite.
In Germany salt domes are one of the favoured options for the disposal of waste in
deep geological formations. The large number of more than 200 existing salt domes in
Northern Germany shows, that salt masses can be exposed to deformation and
halokinesis without being significantly dissolved, even during times where glacial and
interglacial periods occurred and periodically covered the area. During some glacial pe-
riods the salt formations were covered by ice sheets of several 100 m thickness (figure
2.5) exposing the formations to high mechanical stress and causing inflow of a high
amount of freshwater into the overburden.
31
Fig. 2.5 Location of salt domes in Germany and the extension of ice covers dur-
ing the last glacials /NOS 08/
This high persistency to mechanical stresses and other exogenic and endogenic geo-
logical processes in the past gives a good indication that the salt domes in Northern
Germany can provide stable conditions for deep geological repositories (DGR) in the
future.
2.4.2 Regulatory requirements
As said above, there are no regulatory requirements or guidelines how to deal with the
evolution of the repository system up to now. However, PA must be performed accord-
ing to the state of the art. For a detailed description of these criteria see the contribu-
tion of GRS-K. The safety criteria undergo currently a thorough revision. The new regu-
lations have not been fixed yet, but it becomes apparent, that they will contain some
requirements and statements that have a direct impact on the assessment of the evolu-
tion of a repository system. The following issues have to be taken into account:
32
− the main aspect of the safety concept is the proof of the safe enclosure of the em-
placed waste; the most important component of this concept is the proof of the in-
tegrity of the isolating rock zone,
− the assessment period is one million years,
− possible evolutions of the repository system have to be distinguished according to
their probability; the probability defines the way how to deal with an evolution of the
repository system and its consequences,
− the assessment of a human intrusion to the repository can not be carried out by de-
fining probabilities; these evolutions must be analysed in a special set of scenarios,
− events with direct consequences on human health that outreach the consequences
of the repository system influenced by this event are not to be regarded (e. g. im-
pact of a large meteorite),
− the nature of the biosphere and the diet of future generations can not be predicted
for the whole assessment period; the evolution of the biosphere has to be present-
ed in standardised or simplified way based on today’s conditions.
2.4.3.1 Safety concept
As stated in the regulatory requirements, the safety concept is based on the proof of
the safe enclosure of the emplaced waste and its isolation from the environment. The
proof of safety is based on numerical analyses and a collection of plausible arguments
that support the concept for a defined safety level. The safety level and the required
grade of isolation have not been defined yet. The main barrier is provided by the tight
and long-term stable rock salt formation. The safety concept is thus focussed on the
proof of the integrity of the salt formation, which is supposed to guarantee the isolation
of the waste.
The function of the engineered barriers is to reseal the disturbed salt rock formation af-
ter the closure of the repository and to prevent the inflow of significant volumes of
brines into the repository until the convergence of the rock salt seals the man-made
voids and cavities and the safe enclosure of the waste is ensured.
33
2.4.3.2 Repository design
Since a site has not been selected yet in Germany, all design studies have a prelimi-
nary character. However, based on the defined safety concept the following features
must be considered for a repository in rock salt:
− sealing of shafts and access drifts,
− backfilling of voids and cavities with crushed salt,
− minimisation of the water content within the repository (e. g. backfilling moisture) in
order to minimise container corrosion and gas production,
− limiting the maximum temperature in the rock salt formation to 200 °C in order to
avoid mineralogical or crystallographical changes of the rock salt,
− thorough exploration of the salt formation in order to minimise the possibility of the
occurrence of undetected brine inclusions,
− sufficient distance to brittle (e. g. anhydrite) and thermally unstable (for tempera-
tures < 200 °C, e. g. carnallitite) salt layers as well as adjacent rock formations,
− sufficient thickness of the salt formation above the emplaced waste in order to min-
imise the effect of subrosion on the integrity of the geological barrier.
2.4.4 Treatment in PA modelling
There is a high uncertainty in predicting the future development of a repository system
over long time periods. One method to deal with this inevitable uncertainty is the selec-
tion of a set of scenarios, which describes several possible evolutions of the repository
system. In this method, called scenario development, a single scenario specifies one
possible set of features, events and processes (FEP) and provides a description of
their characteristics and sequencing /NEA 01/. In a scenario development a set of such
scenarios must be defined and discussed that contains a complete coverage of all rel-
evant possible future evolutions of the repository system.
The main objective of the scenario development is the identification of relevant FEPs
that affect the future behaviour of the repository system and the synthesis of these
FEPs to an appropriate set of scenarios (i. e. calculation cases for PA models). Beside
its importance for the scope of the PA modelling procedure scenario development is
34
essential for the communication of the modelling results and its underlying assumptions
to the public. For this reason the scenario development has to be as systematically and
transparently as possible.
In the past two basic approaches have been applied in Germany:
− the identification of all FEPs that can have an influence on the repository system
and the emplaced waste and development of scenarios by combining these FEPs
to plausible scenarios (bottom-up approach).
− the determination of initiating FEPs for scenarios, in which barrier functions in the
repository system are affected in such a way that a contact between brine and
waste is possible, and identification of FEPs that are relevant for these scenarios
(top-down approach).
The first approach has the advantage to be more objective and traceable, but the step
from a complete FEP-list to a set of scenarios has not been accomplished yet without
using elements of the top-down approach. For the salt domes in Northern Germany a
FEP-list for spent fuel and HLW was generated exemplarily for a reference site taking
into account both approaches /DBE 08/. The FEP-database developed by OECD/NEA
/NEA 00/ provided the starting point for this FEP-list.
Currently this list is used for the definition of a complete set of scenarios. This work has
not been completed yet, but it is commonly accepted (see WP1.1 ‘scenario develop-
ment’), that such a definition of scenarios must contain a definition of the expected de-
velopment of the repository system, the normal evolution scenario. All other probable
and less probable developments must be defined in altered evolution scenarios. The
distinction between probable and less probable evolutions must be carried out accord-
ing to the regulatory requirements.
2.4.4.1 Normal evolution scenario
The safety concept discussed in chapter 3.1 requires a new definition of the normal
evolution scenario for a salt dome in Northern Germany. This definition has not been
carried out yet, but it should be based on the following assumptions:
− there are no transport pathways in the host rock (the integrity of the host rock has
been proven),
− all geotechnical barriers fulfil their functions during their designed lifetime,
− the material for the backfill and the seal can be compacted in a way, that its re-
maining permeability is low enough to ensure the isolation of the waste from the
groundwater,
− accumulated gas can penetrate the host rock without impairing its integrity,
− the maximum rock temperature will not exceed 200 °C.
In order to make the scenario approach more structured the evidence period of the
normal evolution scenario is generally divided in several sub-periods. Normally two
main phases are distinguished.
Thermal phase
The thermal phase is defined as the time period where the heat generated by the em-
placed waste has a relevant impact on the temperature in the salt formation. Depend-
ent on the definition of a relevant thermal impact this period ends between 103 and 104
years after the closure of the repository. According to the assumptions given above the
convergence of the salt will produce a complete consolidation of the backfill material
within several centuries in the normal evolution scenario. As a consequence the em-
placed waste will be isolated within the rock salt formation and no radionuclide release
from the repository will occur. An excerpt of FEPs from the exi

Documents

Development of Performance Assessment Methodologies